A SOC 2 report carries one overall opinion from the auditor. Unqualified, often called clean, is the best outcome. Qualified means the auditor found a significant problem in part of the scope. Adverse and disclaimer are rarer and more serious. Test exceptions are a separate thing from the opinion.
The four opinions in plain words
Unqualified (clean). The auditor concludes the description is fair and the controls were suitably designed, and for a Type 2 that they operated effectively over the period. A clean opinion can still list exceptions, as long as they do not undermine the conclusion.
Qualified. An "except for" opinion. One or more matters are significant enough to call out, but the rest of the report stands. Customers read this closely, because the qualification names the area.
Adverse. The problems are broad enough that the controls as a whole did not meet the criteria. Most firms work with the client long before this point, so it is uncommon.
Disclaimer. The auditor could not collect enough evidence to give any opinion. Missing records or restricted access are typical causes.
Opinion versus exception
This is the point most first time readers miss. An exception is a single test that did not go as expected, for example one terminated user whose access was removed late. The report lists exceptions in the testing section along with management's response.
The opinion is the auditor's overall judgment. Several exceptions can sit inside a clean opinion, and one serious failure can drive a qualification. They do not map one to one.
For how exceptions arise and how to reduce them, see SOC 2 audit exceptions.
Does a Type 1 have an opinion too
Yes. A Type 1 report also ends with an opinion, but it covers whether the description is fair and the controls were suitably designed at a point in time. It says nothing about how well they operated over time. That is what Type 2 adds.
What to do if you fear a qualification
- Find out early. Ask the auditor for interim feedback during the period rather than at the end.
- Fix the control, not the paperwork. Late evidence invented after the fact does not help and can make things worse.
- Write a clear management response for any exception. Say what happened, what you changed and when.
- Brief your sales team before the report goes out so they do not oversell it.
- Consider a narrower scope next period if a system was not ready, instead of carrying a weak control.
How buyers read it
Buyers differ. Some want a clean opinion and nothing else. Others read the exceptions and judge the response. A calm, specific management response often counts for more than a perfect looking report with no detail. Note that opinion wording and weight can vary by firm, so read the whole opinion section.
Quick check
Does an exception mean we failed?
No. Exceptions are individual test results. Only the auditor's overall opinion tells you whether the report is clean or qualified.
Can we choose not to share a qualified report?
You decide who receives it, subject to the terms of your engagement. Do not describe a qualified report as clean in questionnaires or sales material.
Last reviewed: 19 October 2026.
